Methods, systems and computer program products for determining root causes of detected anomalies in a telecommunications network

Abstract

Methods for determining a cause of a detected anomalous event in a telecommunications system are provided. The methods include detecting an anomalous event in the telecommunications system and retrieving relevant call detail record (CDR) data associated with the detected anomalous event for at least one identified time interval responsive to detecting the anomalous event. The relevant CDR data includes both current CDR data for the at least one identified time interval and historical CDR data for past intervals corresponding to the at least one identified time interval. The relevant CDR data including the current CDR data and the historical CDR data is preprocessed and the preprocessed relevant CDR data is processed to determine a root cause of the detected anomalous event. Processing the preprocessed relevant CDR data includes comparing the current CDR data and the historical CDR data to determine the root cause of the detected anomalous event.

That which is claimed is: 
     
       1. A method for determining a cause of a detected anomalous event in a telecommunications system, the method comprising:
 detecting an anomalous event in the telecommunications system; 
 retrieving relevant call detail record (CDR) data associated with the detected anomalous event for at least one identified time interval responsive to detecting the anomalous event, wherein the relevant CDR data includes both current CDR data for the at least one identified time interval and historical CDR data for past intervals corresponding to the at least one identified time interval; 
 preprocessing the relevant CDR data including the current CDR data and the historical CDR data; 
 processing the preprocessed relevant CDR data to determine a root cause of the detected anomalous event, wherein processing the preprocessed relevant CDR data comprises comparing the current CDR data and the historical CDR data to determine the root cause of the detected anomalous event; 
 confirming that the detected anomalous event is a true positive event by:
 calculating relevant summary statistics corresponding to a metric used to detect the anomalous event, the relevant summary statistics being calculated from the current and historical and current CDR data; 
 performing a statistical hypothesis test on the calculated relevant summary statistics selected using the metric; and 
 determining if all conditions of the statistical hypothesis test performed on the calculated relevant summary statistics are met based on results of the statistical hypothesis test; and 
 
 generating a report including results of comparison and the determined root cause of the detected anomalous event. 
 
     
     
       2. The method of  claim 1 , wherein the metric is one of answer-seizure rate (ASR) volume of attempted calls (CVA); volume of failed calls (CVF);
 and volume of successful calls (CVS). 
 
     
     
       3. The method of  claim 1 , wherein determining comprises:
 determining that the anomalous event is a true positive if a determined probability, p-value, is found to be below a predetermined significance level; and 
 determining that the anomalous event is false positive if the p-value is found to be above the predetermined significance level. 
 
     
     
       4. The method of  claim 1 , wherein preprocessing the relevant CDR data including the current CDR data and the historical CDR data comprises:
 checking CDR fields present in both the current CDR data and the historical CDR data to determine if the CDR fields match expected fields; 
 forcing the CDR fields to be a correct data type, wherein a data type is one of string, integer, float and datetime; and 
 determining if calling number fields and called number fields in the relevant CDR data contain an entire appropriate country calling code. 
 
     
     
       5. The method of  claim 4 , further comprising removing country calling codes from the relevant CDR data if it is determined that all CDRs are from a single country. 
     
     
       6. The method of  claim 1 , wherein processing the preprocessed relevant CDR data comprises:
 computing values for at least one selected CDR field of the preprocessed relevant CDR data including the current CDR data and the historical CDR data for the at least one identified time interval; 
 determining if any of the values for the at least one selected CDR fields are statistically significant root causes; 
 filtering the preprocessed relevant CDR datasets including the current and historical CDR data codes found to be statistically significant to provide filtered results; and 
 processing the filtered results to locate CDRs fields determined to be significant. 
 
     
     
       7. The method of  claim 6 , wherein processing the preprocesses relevant CDR data further comprises:
 concluding that no standard residual are significant if any standard residual associated with the at least one selected CDR field is less than a positive z-statistic threshold; and 
 labeling data as a significant root cause if any standard residual associated with the at least one selected CDR field are greater than a positive z-statistic threshold. 
 
     
     
       8. The method of  claim 6 , wherein the CDR data is associated with one of session initiated protocol (SIP) telephony calls and hypertext transfer protocol (HTTP) telephony calls. 
     
     
       9. A system for determining a cause of a detected anomalous event in a telecommunications system, the system comprising:
 a processor; and 
 a non-transitory computer readable medium to store a set of instructions for execution by the processor, the set of instructions to cause the processor to:
 detect an anomalous event in the telecommunications system; 
 retrieve relevant call detail record (CDR) data associated with the detected anomalous event for at least one identified time interval responsive to detection of the anomalous event, wherein the relevant CDR data includes both current CDR data for the at least one identified time interval and historical CDR data for past intervals corresponding to the at least one identified time interval; 
 preprocess the relevant CDR data including the current CDR data and the historical CDR data; 
 process the preprocessed relevant CDR data to determine a root cause of the detected anomalous event by comparing the current CDR data and the historical CDR data to determine the root cause of the detected anomalous event; 
 confirm that the detected anomalous event is a true positive event by configuring the set of instructions to cause the processor to: calculate relevant summary statistics corresponding to a metric used to detect the anomalous event, the relevant summary statistics being calculated from the current and historical and current CDR data; perform a statistical hypothesis test on the calculated relevant summary statistics selected using the metric; and determine if all conditions of the statistical hypothesis test performed on the calculated relevant summary statistics are met based on results of the statistical hypothesis test; and 
 generate a report including results of comparison and the determined root cause of the detected anomalous event. 
 
 
     
     
       10. The system of  claim 9 , wherein the metric is one of answer-seizure rate (ASR) volume of attempted calls (CVA); volume of failed calls (CVF); and volume of successful calls (CVS). 
     
     
       11. The system of  claim 9 , wherein the set of instructions further cause the processor to:
 determine that the anomalous event is a true positive if a determined probability, p-value, is found to be below a predetermined significance level; and 
 determine that the anomalous event is false positive if the p-value is found to be above the predetermined significance level. 
 
     
     
       12. The system of  claim 9 , wherein the set of instructions further cause the processor to preprocess the relevant CDR data including the current CDR data and the historical CDR data by:
 checking CDR fields present in both the current CDR data and the historical CDR data to determine if the CDR fields match expected fields; 
 forcing the CDR fields to be a correct data type, wherein a data type is one of string, integer, float and datetime; and 
 determining if calling number fields and called number fields in the relevant CDR data contain an entire appropriate country calling code. 
 
     
     
       13. The system of  claim 12 , wherein the set of instructions further cause the processor to remove country calling codes from the relevant CDR data if it is determined that all CDRs are from a single country. 
     
     
       14. The system of  claim 9 , wherein the set of instructions that cause the processor to process the relevant CDR data comprises a set of instructions to cause the processor to further:
 compute values for at least one selected CDR field of the preprocessed relevant CDR data including the current CDR data and the historical CDR data for the at least one identified time interval; 
 determine if any of the values for the at least one selected CDR fields are statistically significant root causes; 
 filter the preprocessed relevant CDR datasets including the current and historical CDR data codes found to be statistically significant to provide filtered results; and 
 
       process the filtered results to locate CDRs fields determined to be significant. 
     
     
       15. The system of  claim 14 , wherein the set of instructions to cause the processor to process further comprises a set of instructions to cause the processor to further:
 conclude that no standard residual are significant if any standard residual associated with the at least one selected CDR field is less than a positive z-statistic threshold; and 
 label data as a significant root cause if any standard residual associated with the at least one selected CDR field are greater than a positive z-statistic threshold. 
 
     
     
       16. The system of  claim 14 , wherein the CDR data is associated with one of SR telephony calls and HTTP telephony calls. 
     
     
       17. A computer for determining a cause of a detected anomalous event in a telecommunications system, the computer comprising:
 one or more memories; 
 one or more processors, communicatively coupled to the one or more memories, the one or more processors configured to:
 detect an anomalous event in the telecommunications system; 
 retrieve relevant call detail record (CDR) data associated with the detected anomalous event for at least one identified time interval responsive to detection of the anomalous event, wherein the relevant CDR data includes both current CDR data for the at least one identified time interval and historical CDR data for past intervals corresponding to the at least one identified time interval; 
 preprocess the relevant CDR data including the current CDR data and the historical CDR data; 
 process the preprocessed relevant CDR data to determine a root cause of the detected anomalous event by comparing the current CDR data and the historical CDR data to determine the root cause of the detected anomalous event; 
 confirm that the detected anomalous event is a true positive event by configuring the one or more processors to: calculate relevant summary statistics corresponding to a metric used to detect the anomalous event, the relevant summary statistics being calculated from the current and historical and current CDR data; perform a statistical hypothesis test on the calculated relevant summary statistics selected using the metric; and determine if all conditions of the statistical hypothesis test performed on the calculated relevant summary statistics are met based on results of the statistical hypothesis test; and 
 generate a report including results of comparison and the determined root cause of the detected anomalous event. 
 
 
     
     
       18. The computer of  claim 17 , wherein the metric is one of answer-seizure rate (ASR) volume of attempted calls (CVA); volume of failed calls (CVF); and volume of successful calls (CVS). 
     
     
       19. The computer of  claim 17 , wherein the one or more processors are further configured to:
 determine that the anomalous event is a true positive if a determined probability, p-value, is found to be below a predetermined significance level; and 
 determine that the anomalous event is false positive if the p-value is found to be above the predetermined significance level. 
 
     
     
       20. The computer of  claim 17 , wherein the one or more processors are further configured to preprocess the relevant CDR data including the current CDR data and the historical CDR data by:
 checking CDR fields present in both the current CDR data and the historical CDR data to determine if the CDR fields match expected fields; 
 forcing the CDR fields to be a correct data type, wherein a data type is one of string, integer, float and datetime; and 
 determining if calling number fields and called number fields in the relevant CDR data contain an entire appropriate country calling code. 
 
     
     
       21. The computer of  claim 20 , wherein the one or more processors are further configured to remove country calling codes from the relevant CDR data if it is determined that all CDRs are from a single country. 
     
     
       22. The computer of  claim 17 , wherein the one or more processors configured to process the relevant CDR data comprises one or more processors configured to:
 compute values for at least one selected CDR field of the preprocessed relevant CDR data including the current CDR data and the historical CDR data for the at least one identified time interval; 
 determine if any of the values for the at least one selected CDR fields are statistically significant root causes; 
 filter the preprocessed relevant CDR datasets including the current and historical CDR data codes found to be statistically significant to provide filtered results; and 
 
       process the filtered results to locate CDRs fields determined to be significant. 
     
     
       23. The computer of  claim 22 , wherein the one or more processors are further configured to:
 conclude that no standard residual are significant if any standard residual associated with the at least one selected CDR field is less than a positive z-statistic threshold; and 
 label data as a significant root cause if any standard residual associated with the at least one selected CDR field are greater than a positive z-statistic threshold. 
 
     
     
       24. The computer of  claim 22 , wherein the CDR data is associated with one of session initiated protocol (SIP) telephony calls and hypertext transfer protocol (HTTP) telephony calls.